Windows Overview Dashboard error. Error parsing dashboard XML: The URI to be decoded is not a valid encoding. Go to "Edit Source" to fix Source: Windows Overview - v2.4

General Information System Statistics Panel

index=winevents EventCode=4624 OR EventCode=528 |dedup user |stats count(user)valuenone0standardNumber of Active Users0none|inputlookup AD_Users.csv |stats count(DisplayName)valueblock0standard1Total Usersnone["0xd93f3c","0x555"][0]11absoluteauto1searchindex=winevents |dedup host |stats count(host)valuenone0standard0Number of Active Hostsnone|inputlookup AD_Hosts.csv |stats count(DisplayName)valueblock0standard1Total Hostsnone["0xd93f3c","0x555"][0]11absoluteauto1search

User Account Action Panel

index=winevents EventCode=4720 OR EventCode=624 | chart dc(user)valueblock011inverseabsolute11["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]-7dNew Accounts/app/IA_Overview/search?q=index=winevents EventCode=4720 OR EventCode=624 | eval PerByAcct_7=mvindex(Account_Name,0) | eval PerByAcct_XP=Caller_User_Name| eval PerByAcct=coalesce(PerByAcct_7,PerByAcct_XP)| table EventCode, signature, PerByAcct, user, host, _time | rename PerByAcct AS "Preformed By", user AS "Preformed To"searchallindex=winevents EventCode=625 OR EventCode=626 OR EventCode=629 OR EventCode=4722 OR EventCode=4725 | chart countvalueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]11inverseabsolute-7dAccount Modifications11/app/IA_Overview/search?q=index=winevents EventCode=625 OR EventCode=626 OR EventCode=629 OR EventCode=4722 OR EventCode=4725| eval PerByAcct_7=mvindex(Account_Name,0) | eval PerByAcct_XP=Caller_User_Name| eval PerByAcct=coalesce(PerByAcct_7,PerByAcct_XP)| table EventCode, signature, PerByAcct, user, host, _time | rename PerByAcct AS "Preformed By", user AS "Preformed To"index=winevents EventCode=630 OR EventCode=4726 |chart countvalueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]11standardabsoluteautoAccounts Deleted11/app/IA_Overview/search?q=index=winevents EventCode=630 OR EventCode=4726 | eval PerByAcct_7=mvindex(Account_Name,0) | eval PerByAcct_XP=Caller_User_Name| eval PerByAcct=coalesce(PerByAcct_7,PerByAcct_XP)| table EventCode, signature, PerByAcct, user, host, _time | rename PerByAcct AS "Preformed By", user AS "Preformed To"index=winevents EventCode=627 OR EventCode=4723 OR EventCode=628 OR EventCode=4724 Account_Name!=*$ |chart countvalueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]11standardabsoluteautoPassword Changes11/app/IA_Overview/search?q=index=winevents EventCode=627 OR EventCode=4723 OR EventCode=628 OR EventCode=4724 Account_Name!=*$ | eval PerByAcct_7=mvindex(Account_Name,0) | eval PerByAcct_XP=Caller_User_Name| eval PerByAcct=coalesce(PerByAcct_7,PerByAcct_XP)| table EventCode, signature, PerByAcct, user, host, _time | rename PerByAcct AS "Preformed By", user AS "Preformed To"index=winevents EventCode=644 OR EventCode=4740|chart countvalueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]11standardabsoluteautoAccount Lockouts11/app/IA_Overview/search?q=index=winevents EventCode=644 OR EventCode=4740 | table EventCode, signature, user, host, _time

Computer Account Actions Panel

(Investigate any actions that appear here)

index=winevents EventCode=4741 OR EventCode=645 | stats count(host)valueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-7dNew Computerstruetrue/app/IA_Overview/search?q=index=winevents EventCode=4741 OR EventCode=645 | table EventCode, signature, host, user, _timeindex=winevents EventCode=4743 OR EventCode=647 | stats count(host)valueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-7dDeleted Computerstruetrue/app/IA_Overview/search?q=index=winevents EventCode=4743 OR EventCode=647 | table EventCode, signature, host, user, _timeindex=winevents EventCode=1202 | stats count(host)valueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-7dGroup Policy Errorstruetrue/app/IA_Overview/search?q=index=winevents EventCode=1202 | stats count sparkline AS Trend by host | sort - countindex=winevents EventCode=4609 OR EventCode=513 | stats count(host)valueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,3,5]truetrueinverseabsolute-24hShutdownstruetrue/app/IA_Overview/search?q=index=winevents EventCode=4609 OR EventCode=513 | table EventCode, signature, host, user, _time| metadata type=hosts index=winevents | table host, lastTime | eval Checkin = relative_time(now(),"-2h") | where lastTime < Checkin | convert ctime(lastTime) as lastTime | stats count(host)valueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-7dMissing Forwaderstruetrue/app/IA_Overview/search?q=| metadata type=hosts index=winevents | table host, lastTime | eval Checkin = relative_time(now(),"-2h") | where lastTime < Checkin | convert ctime(lastTime) as lastTime| table host, lastTime | sort - lastTimesearchallindex=winevents SourceName=MsiInstaller EventCode=11707 host="*" | stats count(host)valueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-7dSoftware Installstruetrue/app/IA_Overview/SW_Detailedindex=winevents SourceName=MsiInstaller EventCode=11724 host="*" | stats count(host)valueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-7dSoftware Uninstallstruetruesearchsearchresult/app/IA_Overview/SW_Detailedindex=winevents EventCode=7 EventType=4 latest=now earliest=-30d@d| stats first(1) by host| stats count(host)valueblock0["0xd93f3c","0x65a637"][0]truetrueinverseabsolute-7dAV Updatestruetruesearchsearchresult/app/IA_Overview/search?q=index=winevents EventCode=7 EventType=4 | stats count sparkline AS Trend by host| sort + Date

Data Loss Protection Action Panel

(Investigate any actions that appear here)

index=winevents sourcetype="WinEventLog:System" SourceName=scomc EventCode=26 | transaction _time, host, user | stats countvalueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-7dShadow Readstruetruesearchsearchresult/app/IA_Overview/DLP_Detailedindex=winevents sourcetype="WinEventLog:System" SourceName=scomc EventCode=25 | transaction _time, host, user | stats countvalueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-24hShadow Writestruetruesearchsearchresult/app/IA_Overview/DLP_Detailedindex=winevents sourcetype="WinEventLog:System" SourceName=scomc EventCode=18 | transaction _time, host, user | stats countvalueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-24hFailed Readstruetruesearchsearchresult/app/IA_Overview/DLP_Detailedindex=winevents sourcetype="WinEventLog:System" SourceName=scomc EventCode=19 | transaction _time, host, user| stats countvalueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-24hFailed Writestruetruesearchsearchresult/app/IA_Overview/DLP_Detailedindex=winevents sourcetype="WinEventLog:System" SourceName=scomc (EventCode=14 OR EventCode=16) | transaction _time, host, user| stats countvalueblock0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]truetrueinverseabsolute-24hMedia/Device Actionstruetruesearchsearchresult/app/IA_Overview/DLP_Detailedindex=winevents EventCode=4625 OR EventCode=529 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=535 OR EventCode=537 | stats counttrendnone0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]11inverseabsolute-24hFailed Logins11search/app/IA_Overview/search?q=index=winevents EventCode=4625 OR EventCode=529 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=535 OR EventCode=537 | stats count sparkline AS Trend by user, signature | sort - countindex=winevents sourcetype="WinEventLog:Security" (EventCode=4625 Sub_Status=0xC0000064) OR (EventCode=529) |eval Date=strftime(_time, "%Y/%m/%d") |rex "Which\sLogon\sFailed:\s+Security\sID:\s+\S.*\s+\w+\s\w+\S\s.(?\S.*)" | eval uacct=coalesce(facct,User_Name)| stats count sparkline AS Trend by uacct, host | rename count as "Attempts", uacct as "Account" | sort - Attemptstruetruenonecell10#5379af#CCDDFF125pxindex=winevents EventCode=4624 OR EventCode=528 Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10 OR Logon_Type=11 | eval logon_hour=strftime(_time, "%H") | where (logon_hour > 18 OR logon_hour < 6) | stats counttrendnone0["0x65a637","0xf7bc38","0xf58f39","0xd93f3c"][0,10,100]11inverseabsolute-24hAfter Hours Logins11search/app/IA_Overview/search?q=index=winevents sourcetype="WinEventLog:Security" EventCode=4624 OR EventCode=528 Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10 OR Logon_Type=11 | eval logon_hour=strftime(_time, "%H") | where (logon_hour > 18 OR logon_hour < 6) | stats count sparkline AS Trend by user, host | rename count as "Attempts", user as "Account" | sort - Attemptsindex=winevents sourcetype="WinEventLog:Security" EventCode=4624 OR EventCode=528 Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10 OR Logon_Type=11 | eval logon_hour=strftime(_time, "%H") | where (logon_hour > 18 OR logon_hour < 6) | stats count sparkline AS Trend by user, host | rename count as "Attempts", user as "Account" | sort - Attemptstruetruenonecell101#5379af#CCDDFF25pxindex=winevents EventCode=4624 [|inputlookup AD_Groups.csv| search group_name="Domain Admins" |table member_name| rename member_name AS user]|stats count sparkline AS Trend by user | sort - count-90d@dnow1#5379af#CCDDFF25px/app/IA_Overview/Win_Priv_Detail?form.usertok=$click.value2$